5 ms·

Question for people with more expertise here. I just switched to Android recently because I don't fancy getting mugged again for a huge pile of cash for an iPho

by baz00 3y ago

Question for people with more expertise here. I just switched to Android recently because I don't fancy getting mugged again for a huge pile of cash for an iPhone. So I've got a Pixel 6A. It's pretty much loaded up with MSFT software and some very well known high profile apps. What risks do I have if I stay out of the play store gutter?

kramerger 3y ago
Android had 3 zero days in 2022, iOS had 7. I think they are pretty much similar if you don't install random crap. I suspect this article is about a bug in Play Protect, which is an on-device security scanner. I don't think iOS has something similar.
- charcircuit 3y ago
  Both platforms scan apps for malware when you upload them to the store before they can be downloaded by users.
  - kramerger 3y ago
    Play Protect runs locally on the phone and also covers sideloaded apps.
    - charcircuit 3y ago
      That is unrelated to the article.
      - kramerger 3y ago
        Please read the article again :) The attack vector was normal apps purchased by the hackers were modified to download and install malicious apps. This should have been caught by Play Protect on the device, but failed due to the bug
        charcircuit 3y ago
        It would have been caught as the apks were uploaded to the store. Before anyone would be able to download it.
        kramerger 3y ago
        Read the article :) :) It has a link to the original report
        charcircuit 3y ago
        I don't see what you are talking about. There is still no mention of play protect.
- 112233 3y ago
  iOS receives immediate security updates on supported devices (even thos that do not run the latest iOS version), while most two year old Androids have two updates a year if at all.
jeroenhd 3y ago
Practically: none, for you at least. Don't download Microsoft Teams if it claims an app developer with an unrecognisable name and only 500 downloadeds, don't download cracked games, be wary of the obvious free-to-play clones, and if a web page shows a flashing gif warning you that Whatsapp is outdated, don't install the APK file it's trying to push through your browser. It's also important to keep your browser up to date and to think before you grant apps permission described like "control the entire screen" and "give app access to all input and screen content". Android malware is not that different from Windows malware. It spreads through devices infected from the factory, pirated software, fake download ads, and less commonly, through clones and abandonware on official storefronts like Google Play. This threat actor is buying abandonware and spreading viruses through updates. Dime-in-a-dozen PDF readers and file managers (that your phone already came with anyway) are at risk, but if you stick to reputable brands you'll be fine. Pick "Google Drive PDF" over "Insomnia Media PDF Viewer - Reader & Editor" with 10k downloads. Google Play comes with an antivirus program built in (Google Play Protect) that will warn you of known risks. You can disable it if you don't want Google to know about every app you install from other sources, but if you leave it enabled you'll minimize the risk of getting infected. If you want to be sure you're not getting infected, use F-Droid. F-Droid compiles open-source apps on their own servers, so the source code they receive is the source code the compiled APK uses. Even if your app is open source, there's no way to upload a precompiled APK to the F-Droid website. This makes introducing malware without anyone noticing quite difficult.
- kbenson 3y ago
  > F-Droid compiles open-source apps on their own servers, so the source code they receive is the source code the compiled APK uses. Even if your app is open source, there's no way to upload a precompiled APK to the F-Droid website. This makes introducing malware without anyone noticing quite difficult. This is a common model, and is basically how most Linux distros work, but it only scales (safely) with people actually paying attention. How many people does F-droid have reviewing the apps that update that they build? I agree it will be hard to introduce malware without anyone noticing in a strict sense, I'm just not sure they have enough resources to notice before it becomes a problem given how I assume that must work, but I would be happy to be wrong.
stOneskull 3y ago
google needs to clean up the whole QR code reader app category. they trick users by having a big button saying 'OPEN' that takes the user to a website asking them to enter their credit card to verify their ID.
MichaelRo 3y ago
Well I never had an iPhone and from Android I only had Chinese stuff coze it's cheap. Mostly Xiaomi but also weird stuff like Lumigon, which for $100 had an infrared camera and (at the time) an unbelievable 128 Gb of storage. I also never had viruses or malware or what else because I only install official app versions (Teams / WhatsApp / Skype messengers, Netflix / Amazon / HBO / Disney streaming platforms, Google / Microsoft / Custom Bank authenticators, Chrome / Firefox browsers etc). My kid though ... my God. He installs random games from PlayStore, if I wouldn't have seen I wouldn't have believed it. Every corner of the phone was infested with ads and popups and crap, had to do a factory reset to clean it as even after uninstalling the games the crapyware continued). Overall if you stay out of games and stick to tried and tested official apps, you're good. Well, apart from Chinese phone bugs, which are unavoidable given the price tag. Like at least I got used to Xiaomi's bugs but my kid just wanted so much a Huawei Honor Magic5 Lite coze it looks nice and that's all that matters. Crashed once right when I was setting up my Google account, second attempt succeeded. Then started pre-installed YouTube and took 5 crashes before the 6th attempt finally succeeded and the application started. For the same money he could have gotten a Redmi Note 12 Pro from Xiaomi, with slightly better hardware specs (but not the slick curved glass look) and as it seems, leaps and bounds better tested software.
- DANmode 3y ago
  > Every corner of the phone was infested with ads and popups and crap, had to do a factory reset to clean it as even after uninstalling the games the crapyware continued). RIP the other devices on your network.
- pajko 3y ago
  Xiaomi phones themselves are malware. My EU Redmi 8 was running tcpdump in the background 24/7, capturing the first 50 bytes of every packet and sending the logs to some chinese server twice per day. One would say 50 bytes is not much and most of the traffic is encrypted (HTTPS, etc...) but the IP addresses are still in there, the DNS requests and replies are not encrypted, and having the first 50 bytes of IP packets might be enough to capture an unencrypted IMAP, SMTP or POP3 login. It's the part of the "recover lost/stolen phone" thing, but it's an overkill for that purpose. It's not documented what they are doing with the data, and this clearly violates the GDPR. Btw. never had this feature enabled. Flashed a custom ROM the next day after my discovery.

by baz00 3y ago

kramerger 3y ago

Android had 3 zero days in 2022, iOS had 7. I think they are pretty much similar if you don't install random crap. I suspect this article is about a bug in Play Protect, which is an on-device security scanner. I don't think iOS has something similar.

charcircuit 3y ago
Both platforms scan apps for malware when you upload them to the store before they can be downloaded by users.
- kramerger 3y ago
  Play Protect runs locally on the phone and also covers sideloaded apps.
  - charcircuit 3y ago
    That is unrelated to the article.
    - kramerger 3y ago
      Please read the article again :) The attack vector was normal apps purchased by the hackers were modified to download and install malicious apps. This should have been caught by Play Protect on the device, but failed due to the bug
      - charcircuit 3y ago
        It would have been caught as the apks were uploaded to the store. Before anyone would be able to download it.
        kramerger 3y ago
        Read the article :) :) It has a link to the original report
        charcircuit 3y ago
        I don't see what you are talking about. There is still no mention of play protect.
112233 3y ago
iOS receives immediate security updates on supported devices (even thos that do not run the latest iOS version), while most two year old Androids have two updates a year if at all.

jeroenhd 3y ago

Practically: none, for you at least. Don't download Microsoft Teams if it claims an app developer with an unrecognisable name and only 500 downloadeds, don't download cracked games, be wary of the obvious free-to-play clones, and if a web page shows a flashing gif warning you that Whatsapp is outdated, don't install the APK file it's trying to push through your browser. It's also important to keep your browser up to date and to think before you grant apps permission described like "control the entire screen" and "give app access to all input and screen content". Android malware is not that different from Windows malware. It spreads through devices infected from the factory, pirated software, fake download ads, and less commonly, through clones and abandonware on official storefronts like Google Play. This threat actor is buying abandonware and spreading viruses through updates. Dime-in-a-dozen PDF readers and file managers (that your phone already came with anyway) are at risk, but if you stick to reputable brands you'll be fine. Pick "Google Drive PDF" over "Insomnia Media PDF Viewer - Reader & Editor" with 10k downloads. Google Play comes with an antivirus program built in (Google Play Protect) that will warn you of known risks. You can disable it if you don't want Google to know about every app you install from other sources, but if you leave it enabled you'll minimize the risk of getting infected. If you want to be sure you're not getting infected, use F-Droid. F-Droid compiles open-source apps on their own servers, so the source code they receive is the source code the compiled APK uses. Even if your app is open source, there's no way to upload a precompiled APK to the F-Droid website. This makes introducing malware without anyone noticing quite difficult.

kbenson 3y ago
> F-Droid compiles open-source apps on their own servers, so the source code they receive is the source code the compiled APK uses. Even if your app is open source, there's no way to upload a precompiled APK to the F-Droid website. This makes introducing malware without anyone noticing quite difficult. This is a common model, and is basically how most Linux distros work, but it only scales (safely) with people actually paying attention. How many people does F-droid have reviewing the apps that update that they build? I agree it will be hard to introduce malware without anyone noticing in a strict sense, I'm just not sure they have enough resources to notice before it becomes a problem given how I assume that must work, but I would be happy to be wrong.

stOneskull 3y ago

google needs to clean up the whole QR code reader app category. they trick users by having a big button saying 'OPEN' that takes the user to a website asking them to enter their credit card to verify their ID.

MichaelRo 3y ago

Well I never had an iPhone and from Android I only had Chinese stuff coze it's cheap. Mostly Xiaomi but also weird stuff like Lumigon, which for $100 had an infrared camera and (at the time) an unbelievable 128 Gb of storage. I also never had viruses or malware or what else because I only install official app versions (Teams / WhatsApp / Skype messengers, Netflix / Amazon / HBO / Disney streaming platforms, Google / Microsoft / Custom Bank authenticators, Chrome / Firefox browsers etc). My kid though ... my God. He installs random games from PlayStore, if I wouldn't have seen I wouldn't have believed it. Every corner of the phone was infested with ads and popups and crap, had to do a factory reset to clean it as even after uninstalling the games the crapyware continued). Overall if you stay out of games and stick to tried and tested official apps, you're good. Well, apart from Chinese phone bugs, which are unavoidable given the price tag. Like at least I got used to Xiaomi's bugs but my kid just wanted so much a Huawei Honor Magic5 Lite coze it looks nice and that's all that matters. Crashed once right when I was setting up my Google account, second attempt succeeded. Then started pre-installed YouTube and took 5 crashes before the 6th attempt finally succeeded and the application started. For the same money he could have gotten a Redmi Note 12 Pro from Xiaomi, with slightly better hardware specs (but not the slick curved glass look) and as it seems, leaps and bounds better tested software.

DANmode 3y ago
> Every corner of the phone was infested with ads and popups and crap, had to do a factory reset to clean it as even after uninstalling the games the crapyware continued). RIP the other devices on your network.
pajko 3y ago
Xiaomi phones themselves are malware. My EU Redmi 8 was running tcpdump in the background 24/7, capturing the first 50 bytes of every packet and sending the logs to some chinese server twice per day. One would say 50 bytes is not much and most of the traffic is encrypted (HTTPS, etc...) but the IP addresses are still in there, the DNS requests and replies are not encrypted, and having the first 50 bytes of IP packets might be enough to capture an unencrypted IMAP, SMTP or POP3 login. It's the part of the "recover lost/stolen phone" thing, but it's an overkill for that purpose. It's not documented what they are doing with the data, and this clearly violates the GDPR. Btw. never had this feature enabled. Flashed a custom ROM the next day after my discovery.